£7.7 million bounty offered in hunt for members of North Korea-backed hacking group

Andariel primarily targeted defence, aerospace, nuclear and engineering organisations, but also acted against the medical and energy sectors, according to the UK’s National Cyber Security Centre.

The UK, US and South Korea have accused a North Korea-backed cyber group of carrying out an online espionage campaign to steal military and nuclear secrets.

The “Andariel” group has been compromising organisations around the globe as it attempts to get hold of sensitive and classified technical information and intellectual property data, according to the UK’s National Cyber Security Centre (NCSC).

The centre, along with the FBI in the US and South Korea’s national intelligence service, have issued a joint warning and advisory note about Andariel’s actions.

They have urged critical infrastructure organisations to “stay vigilant” against such cyber operations.

It comes as the US government offers a reward of up to $10m (£7.7m) to anyone with information that helps it find members of malicious cyber groups targeting America on behalf of foreign governments.

The reward will be offered to any person who helps identify or locate Rim or any other actors who are found to be targeting the US.

Andariel focuses on targeting defence contractors, military organisations and governments for espionage.

Over time, the group has branched out into other sectors, targeting information on nuclear weapons and, particularly during the pandemic, organisations in the life sciences and pharmaceutical sector, according to research by cyber security company Secureworks.

North Korea is a secretive and authoritarian state, which is officially known as the Democratic People’s Republic of Korea (DPRK), and is headed by supreme leader Kim Jong Un.

Andariel’s campaign was carried out to “further the regime’s military and nuclear ambitions”, said the UK cyber security centre.

NCSC director of operations Paul Chichester said: “The global cyber espionage operation that we have exposed today shows the lengths that DPRK state-sponsored actors are willing to go to pursue their military and nuclear programmes.”

Andariel is part of DPRK’s Reconnaissance General Bureau (RGB) 3rd bureau, and the group’s malicious cyber activities pose an ongoing threat to critical infrastructure organisations globally, the centre believes.

What did group target?

The group primarily targeted defence, aerospace, nuclear and engineering organisations, but also acted against the medical and energy sectors, according to the NCSC, which is part of the GCHQ intelligence agency.

Andariel has tried to obtain information such as contract specification, design drawings and project details, the NCSC claimed.

Secureworks, which has been studying the group, believes the actors are government employees in North Korea who work for the country’s intelligence agency.

Andariel has been found to engage in ransomware attacks, where hackers attack a system or obtain information and charge a sum of money to its owner for it to be released.

Ransomware attacks

As part of its operations, Andariel also launched ransomware attacks against US healthcare organisations in order to extort payments and fund further espionage activity.

The US state department said Rim and others “conspired to hack into the computer systems of US hospitals and other healthcare providers, install Maui ransomware, and extort ransoms”.

In one computer intrusion operation that began in November 2022, the group hacked a US-based defence contractor from which they extracted more than 30 gigabytes of data, including technical information regarding the materials used in military aircraft and satellites.

Source: https://news.sky.com/story/north-korea-backed-group-in-cyber-campaign-to-steal-military-and-nuclear-secrets-13184925